@principles/host-runtime 0.12.2 → 0.13.1

package/dist/index.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { isHostEvent, isHostEventResult, } from '@principles/core/host';
-import { getPromptModelCatalog, resolvePromptBudget } from '@principles/core/runtime-v2';
+import { getPromptModelCatalog, operatorDeclaredContextWindow, resolvePromptBudget } from '@principles/core/runtime-v2';
+import { loadPdConfigForPlugin } from './pd-config.js';
 import { buildActivePrinciplePromptContext } from './active-principle-prompt.js';
 import { createProductionRuleHostGate } from './production-rulehost-gate.js';
 import { createProductionPainEvidenceHandler } from './production-pain-evidence.js';
@@ -212,6 +213,19 @@ export function createProductionHostRuntime(options = {}) {
             // reports `legacy_fifo_prefix_v1` honestly. The selector's fair-rotation
             // capability is retained and stays reachable for callers that DO hold a
             // legitimate advancing round authority.
+            // PRI-1020: the Owner's declared window (.pd/config.yaml promptBudget)
+            // is tier 0 of the budget chain — resolved per host and fed into the
+            // SAME single resolver below. One extra sync config read per prompt
+            // build (the candidates reader loads it independently): deliberate, so
+            // a config flip applies on the next turn with no cache to invalidate.
+            // Malformed config degrades to defaults (no declaration) and is already
+            // surfaced as config_invalid warnings by readPromptActivationCandidates.
+            const promptBudgetHostKind = options.hostKind === 'openclaw' || options.hostKind === 'codex' || options.hostKind === 'workbuddy'
+                ? options.hostKind
+                : undefined;
+            const declaredWindow = promptBudgetHostKind === undefined
+                ? undefined
+                : operatorDeclaredContextWindow(loadPdConfigForPlugin(event.context.workspaceDir).effective.config.promptBudget, promptBudgetHostKind);
             const prompt = await buildActivePrinciplePromptContext({
                 workspaceDir: event.context.workspaceDir,
                 excludePrincipleIds: options.promptExcludePrincipleIds?.(event),
@@ -221,6 +235,8 @@ export function createProductionHostRuntime(options = {}) {
                     // Codex+WorkBuddy model id) against the installed local Pi AI
                     // catalog — no network, no LLM call. Missing/untrusted facts
                     // resolve to the legacy fixed budget with an observable reason.
+                    // PRI-1020: an Owner declaration outranks all of these (tier 0).
+                    ...(declaredWindow !== undefined ? { operatorDeclared: { contextWindowTokens: declaredWindow } } : {}),
                     hostCapacity: event.context.modelContext === undefined
                         ? undefined
                         : {

package/dist/internalization-consumer-cycle.js

@@ -701,6 +701,10 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                     // identity on the live production chain. listForCandidate reads
                     // the ledger from disk per call — no cross-cycle staleness.
                     ledgerIdentity: {
+                        resolveForCandidate: async (candidateId) => {
+                            const candidate = await stateManager.getCandidate(candidateId);
+                            return new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).resolveCandidatePrincipleIdentity(candidateId, candidate?.rawRecommendationKind);
+                        },
                         // PRI-915: availability first — an unreadable ledger must not
                         // read as an unresolved chain.
                         isAvailable: () => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).isAvailable(),
@@ -711,6 +715,10 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
             case 'artificer':
                 runner = new ArtificerRunner({
                     stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultArtificerValidator(),
+                    ledgerIdentity: { resolveForCandidate: async (candidateId) => {
+                            const candidate = await stateManager.getCandidate(candidateId);
+                            return new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).resolveCandidatePrincipleIdentity(candidateId, candidate?.rawRecommendationKind);
+                        } },
                     // PRI-982 (SPEC-PD-IAER-001 FR-02): the preflight-assembled Owner
                     // evidence pack — present only when the authoritative channel is
                     // code_tool_hook AND the readiness gate returned ready (same
@@ -753,6 +761,10 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                     // PRI-915: availability first — an unreadable ledger must surface
                     // as identity_source_unavailable, not as invalid_identity drift.
                     ledgerIdentity: {
+                        resolveForCandidate: async (candidateId) => {
+                            const candidate = await stateManager.getCandidate(candidateId);
+                            return new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).resolveCandidatePrincipleIdentity(candidateId, candidate?.rawRecommendationKind);
+                        },
                         isAvailable: () => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).isAvailable(),
                         hasPrinciple: (principleId) => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).hasPrinciple(principleId),
                     },

package/dist/internalization-consumer-governance.js

@@ -70,6 +70,10 @@ export async function dispatchRolloutActivation(workspaceDir, input, options = {
         // used to mint the principle UUID); candidate lineage reuses the artifact
         // read model plus raw diagnostic_json reads.
         const ledgerIdentity = {
+            getCandidateKind: (candidateId) => {
+                const row = connection.getDb().prepare('SELECT recommendation_kind FROM principle_candidates WHERE candidate_id = ?').get(candidateId);
+                return row !== null && typeof row === 'object' && Object.hasOwn(row, 'recommendation_kind') ? Reflect.get(row, 'recommendation_kind') : undefined;
+            },
             ledger: new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }),
             getArtifactById: artifactReadModel.getArtifactById,
             getTaskDiagnosticJson: (taskId) => {

package/dist/prompt-injection-budget-observation.d.ts

@@ -1,4 +1,4 @@
-import { PROMPT_BUDGET_POLICY_VERSION, type PromptBudgetCapacitySource, type PromptBudgetCapacityStatus, type PromptBudgetFallbackReason, type PromptBudgetResolution } from '@principles/core/runtime-v2';
+import { PROMPT_BUDGET_POLICY_VERSION, type PromptBudgetCapacitySource, type PromptBudgetCapacityStatus, type PromptBudgetFallbackReason, type PromptBudgetResolution, type PromptBudgetConfig } from '@principles/core/runtime-v2';
 import { type PromptInjectionTargetHost } from './prompt-injection-projection.js';
 /**
  * PRI-1017: runtime budget OBSERVATION read model over the EXISTING
@@ -174,3 +174,12 @@ export declare function selectConsoleRuntimeBudgetFacts(input: {
  * rides events or console payloads.
  */
 export declare function runtimeBudgetObservationToResolution(observation: RuntimePromptBudgetObservation): PromptBudgetResolution;
+/**
+ * PRI-1020: the Owner's declared window as a budget resolution, for console
+ * surfaces with NO fresh runtime observation. Goes through the same single
+ * resolver (tier 0) so an injected forecast and the console fallback can
+ * never disagree about what a declaration means. Undefined when the
+ * workspace declares nothing — the caller then keeps the historical fixed
+ * fallback.
+ */
+export declare function operatorDeclaredBudgetResolution(promptBudget: PromptBudgetConfig | undefined, hostKind: PromptInjectionTargetHost): PromptBudgetResolution | undefined;

package/dist/prompt-injection-budget-observation.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { PROMPT_BUDGET_POLICY_VERSION, RUNTIME_V2_PRINCIPLE_BUDGET, isValidContextWindowTokens, promptBudgetCharsForContextWindow, } from '@principles/core/runtime-v2';
+import { PROMPT_BUDGET_POLICY_VERSION, RUNTIME_V2_PRINCIPLE_BUDGET, isValidContextWindowTokens, promptBudgetCharsForContextWindow, resolvePromptBudget, operatorDeclaredContextWindow, } from '@principles/core/runtime-v2';
 import { isPromptInjectionTargetHost, } from './prompt-injection-projection.js';
 /**
  * PRI-1017: runtime budget OBSERVATION read model over the EXISTING
@@ -104,6 +104,7 @@ function parseObservedAt(value) {
     return Number.isFinite(parsed) ? parsed : null;
 }
 const BUDGET_CAPACITY_SOURCES = new Set([
+    'operator_declared',
     'host_effective_window',
     'pi_catalog_exact',
     'legacy_fallback',
@@ -177,7 +178,11 @@ function narrowObservation(parsed, workspaceDir, nowMs) {
     // formula derives from it; the legacy fallback needs the legacy budget, no
     // window, and a bounded reason. Anything else is not a trustworthy fact.
     if (rawStatus === 'confirmed') {
-        if (rawSource !== 'host_effective_window' && rawSource !== 'pi_catalog_exact')
+        // PRI-1020: operator_declared joins the confirmed set — a declared window
+        // is a real window (the Owner's explicit cap), so its observations carry
+        // the window and the exact formula budget like the other confirmed
+        // sources.
+        if (rawSource !== 'operator_declared' && rawSource !== 'host_effective_window' && rawSource !== 'pi_catalog_exact')
             return null;
         if (!isValidContextWindowTokens(rawWindow))
             return null;
@@ -447,3 +452,17 @@ export function runtimeBudgetObservationToResolution(observation) {
         ...(observation.fallbackReason !== null ? { fallbackReason: observation.fallbackReason } : {}),
     };
 }
+/**
+ * PRI-1020: the Owner's declared window as a budget resolution, for console
+ * surfaces with NO fresh runtime observation. Goes through the same single
+ * resolver (tier 0) so an injected forecast and the console fallback can
+ * never disagree about what a declaration means. Undefined when the
+ * workspace declares nothing — the caller then keeps the historical fixed
+ * fallback.
+ */
+export function operatorDeclaredBudgetResolution(promptBudget, hostKind) {
+    const declaredWindow = operatorDeclaredContextWindow(promptBudget, hostKind);
+    if (declaredWindow === undefined)
+        return undefined;
+    return resolvePromptBudget({ operatorDeclared: { contextWindowTokens: declaredWindow } });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.12.2",
+  "version": "0.13.1",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,7 +31,7 @@
     "lint": "eslint \"src/**/*.ts\""
   },
   "dependencies": {
-    "@principles/core": "^1.295.3",
+    "@principles/core": "^1.296.2",
     "@principles/install-layout": "^0.4.0",
     "better-sqlite3": "^13.0.3",
     "js-yaml": "^5.4.3"